The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This vulnerability allows unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-8723 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the vulnerable plugin’s endpoint, allowing them to execute arbitrary PHP code on the server. This can lead to full control over the affected WordPress site, enabling the attacker to manipulate data, install malware, or perform other malicious actions.
Affected Products
- Cloudflare Image Resizing plugin for WordPress (all versions up to 1.5.6): This plugin allows users to resize images on their WordPress site but is vulnerable to remote code execution due to insufficient security measures.
Mitigation
To mitigate this vulnerability, users should update the Cloudflare Image Resizing plugin to the latest version where the issue has been addressed. Additionally, implementing security best practices such as restricting access to sensitive endpoints and regularly monitoring for suspicious activity can help protect against exploitation.